Fix foreach by-ref on property hooks (#6435)

[PurHur]

Summary

• Tag foreach ($arr as &$obj->hookedProp) AssignRef with ASSIGN_REF_FOREACH_PROPERTY_HOOK when php-cfg emits Iterator\Value + optional PropertyFetch prelude.
• VM writes iteration scalars to arrow-hook backing storage (registry getBacking/setBacking) without invoking set hooks; in-loop $obj->hookedProp++ still uses get/set hooks.
• Preprocessor records $this->field targets from arrow get/set hooks for backing resolution.

Closes #6435

Verification

Issue repro:

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro-maintainer/parity_property_hook_foreach_byref.php'

Output: 40 (was 1110)

Compliance:

./script/docker-exec.sh -- bash -lc 'vendor/bin/phpunit --filter property_hook_foreach_byref'

OK (1 test, 1 assertion)

Regression:

./script/docker-exec.sh -- bash -lc 'vendor/bin/phpunit --filter property_hook_assign_ref'

OK (1 test, 1 assertion)

php-src reference

• Zend/zend_property_hooks.c — FE_FETCH_R / foreach iteration on hooked properties
• Zend/zend_execute.c — foreach by-ref assign path

PHP implementation

• lib/Compiler.php, lib/VM.php, lib/SourcePreprocessor/PropertyHooks.php, lib/OpCode.php
• JIT defers ASSIGN_REF_FOREACH_PROPERTY_HOOK to VM (lib/JIT.php)

Made with Cursor